3 ms·

It is also available on f-droid, and they compile the apps themselves instead of distributing compiled apps. So if you trust f-droid, you know it is the same as

It is also available on f-droid, and they compile the apps themselves instead of distributing compiled apps. So if you trust f-droid, you know it is the same as the open source code.

neilv 4y ago
You need parties you trust auditing all the code and each change, before you run it.
- commoner 4y ago
  F-Droid does check code before privacy violations for accepting it. Any potential privacy violations are labeled as "anti-features" and apps that don't meet F-Droid's inclusion criteria are rejected: https://f-droid.org/docs/Inclusion_Policy/ https://f-droid.org/docs/Inclusion_Policy/ Aegis Authenticator passed F-Droid's checks. It has no anti-features: https://f-droid.org/en/packages/com.beemdevelopment.aegis/ https://f-droid.org/en/packages/com.beemdevelopment.aegis/ Aegis doesn't even request the internet permission. Compare that with Authy, which logs users' IP addresses, login activity, phone numbers, and email addresses, and states that users' data and personal information will be shared with third parties for any reason Authy wants to: https://www.twilio.com/legal/privacy/authy https://www.twilio.com/legal/privacy/authy Twilio has had 2 data breaches this year, and the second one involved Authy. Since Authy does not use end-to-end encryption, hackers were able to obtain 2FA credentials from any Authy account, and they compromised the accounts of 93 Authy users: https://techcrunch.com/2022/08/26/twilio-breach-authy/ https://techcrunch.com/2022/08/26/twilio-breach-authy/ On top of that, Authy is closed source and its code has never been audited, not even by F-Droid. There is no way to use Authy without sending your personal information to a service that states it will not promise to keep it private. There is no good reason to trust Authy over Aegis.

3 ms·

It is also available on f-droid, and they compile the apps themselves instead of distributing compiled apps. So if you trust f-droid, you know it is the same as

by jayknight 4y ago

It is also available on f-droid, and they compile the apps themselves instead of distributing compiled apps. So if you trust f-droid, you know it is the same as the open source code.

neilv 4y ago
You need parties you trust auditing all the code and each change, before you run it.
- commoner 4y ago
  F-Droid does check code before privacy violations for accepting it. Any potential privacy violations are labeled as "anti-features" and apps that don't meet F-Droid's inclusion criteria are rejected: https://f-droid.org/docs/Inclusion_Policy/ https://f-droid.org/docs/Inclusion_Policy/ Aegis Authenticator passed F-Droid's checks. It has no anti-features: https://f-droid.org/en/packages/com.beemdevelopment.aegis/ https://f-droid.org/en/packages/com.beemdevelopment.aegis/ Aegis doesn't even request the internet permission. Compare that with Authy, which logs users' IP addresses, login activity, phone numbers, and email addresses, and states that users' data and personal information will be shared with third parties for any reason Authy wants to: https://www.twilio.com/legal/privacy/authy https://www.twilio.com/legal/privacy/authy Twilio has had 2 data breaches this year, and the second one involved Authy. Since Authy does not use end-to-end encryption, hackers were able to obtain 2FA credentials from any Authy account, and they compromised the accounts of 93 Authy users: https://techcrunch.com/2022/08/26/twilio-breach-authy/ https://techcrunch.com/2022/08/26/twilio-breach-authy/ On top of that, Authy is closed source and its code has never been audited, not even by F-Droid. There is no way to use Authy without sending your personal information to a service that states it will not promise to keep it private. There is no good reason to trust Authy over Aegis.